{"id":"CVE-2016-2517","aliases":["DEBIAN-CVE-2016-2517","EUVD-2016-3595","GHSA-3gmh-m5h5-5234","SUSE-SU-2016:1278-1","SUSE-SU-2016:1291-1","SUSE-SU-2016:1471-1","SUSE-SU-2016:1568-1","UBUNTU-CVE-2016-2517","openSUSE-SU-2024:10181-1"],"status":"published","title":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service ...","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08823,"percentile":0.95222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-05-11T12:37:44Z","modified":"2026-08-04T06:04:06Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p7+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p7+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-44.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-44.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-44.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-44.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-44.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p7-44.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p8-46.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p8-46.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p8-46.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","1:4.2.6.p5+dfsg-3ubuntu2.14.04.10","1:4.2.6.p5+dfsg-3ubuntu2.14.04.11","1:4.2.6.p5+dfsg-3ubuntu2.14.04.12","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2","1:4.2.8p4+dfsg-3ubuntu5.3","1:4.2.8p4+dfsg-3ubuntu5.4","1:4.2.8p4+dfsg-3ubuntu5.5","1:4.2.8p4+dfsg-3ubuntu5.6","1:4.2.8p4+dfsg-3ubuntu5.7","1:4.2.8p4+dfsg-3ubuntu5.8","1:4.2.8p4+dfsg-3ubuntu5.9","1:4.2.8p4+dfsg-3ubuntu5.10"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-1.1"}]}],"bundled":60}],"products":[{"vendor":"ntp","product":"ntp"}],"references":[{"url":"http://support.ntp.org/bin/view/Main/NtpBug3010","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/88189","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.kb.cert.org/vuls/id/718152","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"http://www.securitytracker.com/id/1035705","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20171004-0002/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201607-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2517"},{"url":"https://security.netapp.com/advisory/ntap-20171004-0002"},{"url":"https://github.com/advisories/GHSA-3gmh-m5h5-5234"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2517","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161278-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/957226","tags":["report"]},{"url":"https://bugzilla.suse.com/977446","tags":["report"]},{"url":"https://bugzilla.suse.com/977450","tags":["report"]},{"url":"https://bugzilla.suse.com/977451","tags":["report"]},{"url":"https://bugzilla.suse.com/977452","tags":["report"]},{"url":"https://bugzilla.suse.com/977455","tags":["report"]},{"url":"https://bugzilla.suse.com/977457","tags":["report"]},{"url":"https://bugzilla.suse.com/977458","tags":["report"]},{"url":"https://bugzilla.suse.com/977459","tags":["report"]},{"url":"https://bugzilla.suse.com/977461","tags":["report"]},{"url":"https://bugzilla.suse.com/977464","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2519","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161291-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161471-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161568-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/962960","tags":["report"]},{"url":"https://bugzilla.suse.com/979302","tags":["report"]},{"url":"https://bugzilla.suse.com/979981","tags":["report"]},{"url":"https://bugzilla.suse.com/981422","tags":["report"]},{"url":"https://bugzilla.suse.com/982064","tags":["report"]},{"url":"https://bugzilla.suse.com/982065","tags":["report"]},{"url":"https://bugzilla.suse.com/982066","tags":["report"]},{"url":"https://bugzilla.suse.com/982067","tags":["report"]},{"url":"https://bugzilla.suse.com/982068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4957","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-2517","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2517","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9311","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2517","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","status":"published","published":"2017-01-30T21:00:00Z","modified":"2024-08-05T23:32:20.572Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2016-3595","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","status":"published","published":"2017-01-30T21:00:00Z","modified":"2024-08-05T23:32:20Z","updated_at":"2026-11-03T02:22:52.753944Z"}],"ghsa":[{"id":"GHSA-3gmh-m5h5-5234","title":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service ...","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","status":"published","published":"2022-05-17T00:22:32Z","modified":"2025-04-20T03:33:07Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:40.176288Z"}],"nvd":[{"id":"CVE-2016-2517","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","status":"published","published":"2017-01-30T21:59:01.033Z","modified":"2026-06-17T00:44:12.467Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:N/AC:H/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-2517","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","status":"published","published":"2017-01-30T21:59:01.033Z","modified":"2026-03-15T22:21:57.462845Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2517","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey.  NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","status":"published","published":"2017-01-30T21:59:01.033Z","modified":"2026-08-04T06:04:06.395620357Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-2517","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.","status":"published","published":"2017-01-30T21:59:00Z","modified":"2025-10-24T04:45:39Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"openSUSE-SU-2024:10181-1","title":"ntp-4.2.8p9-1.1 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:26.696395Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:1278-1","title":"Security update for ntp","description":"\nThis update for ntp to 4.2.8p7 fixes the following issues:\n\n* CVE-2016-1547, bsc#977459:\n  Validate crypto-NAKs, AKA: CRYPTO-NAK DoS.\n* CVE-2016-1548, bsc#977461: Interleave-pivot\n* CVE-2016-1549, bsc#977451:\n  Sybil vulnerability: ephemeral association attack.\n* CVE-2016-1550, bsc#977464: Improve NTP security against buffer\n  comparison timing attacks.\n* CVE-2016-1551, bsc#977450:\n  Refclock impersonation vulnerability\n* CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig\n  directives will cause an assertion botch in ntpd.\n* CVE-2016-2517, bsc#977455: remote configuration trustedkey/\n  requestkey/controlkey values are not properly validated.\n* CVE-2016-2518, bsc#977457: Crafted addpeer with hmode \u003e 7\n  causes array wraparound with MATCH_ASSOC.\n* CVE-2016-2519, bsc#977458: ctl_getitem() return value not\n  always checked.\n* This update also improves the fixes for:\n  CVE-2015-7704, CVE-2015-7705, CVE-2015-7974\n\nBugs fixed:\n- Restrict the parser in the startup script to the first\n  occurrance of 'keys' and 'controlkey' in ntp.conf (bsc#957226).\n","status":"published","published":"2016-05-11T12:37:44Z","modified":"2026-02-04T02:37:24.950334Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1291-1","title":"Security update for ntp","description":"\nThis update for ntp to 4.2.8p7 fixes the following issues:\n\n* CVE-2016-1547, bsc#977459:\n  Validate crypto-NAKs, AKA: CRYPTO-NAK DoS.\n* CVE-2016-1548, bsc#977461: Interleave-pivot\n* CVE-2016-1549, bsc#977451:\n  Sybil vulnerability: ephemeral association attack.\n* CVE-2016-1550, bsc#977464: Improve NTP security against buffer\n  comparison timing attacks.\n* CVE-2016-1551, bsc#977450:\n  Refclock impersonation vulnerability\n* CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig\n  directives will cause an assertion botch in ntpd.\n* CVE-2016-2517, bsc#977455: remote configuration trustedkey/\n  requestkey/controlkey values are not properly validated.\n* CVE-2016-2518, bsc#977457: Crafted addpeer with hmode \u003e 7\n  causes array wraparound with MATCH_ASSOC.\n* CVE-2016-2519, bsc#977458: ctl_getitem() return value not\n  always checked.\n* This update also improves the fixes for:\n  CVE-2015-7704, CVE-2015-7705, CVE-2015-7974\n\nBugs fixed:\n- Restrict the parser in the startup script to the first\n  occurrance of 'keys' and 'controlkey' in ntp.conf (bsc#957226).\n","status":"published","published":"2016-05-12T14:58:24Z","modified":"2026-02-04T02:42:43.615706Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1471-1","title":"Security update for ntp","description":"\nThis update for ntp fixes the following issues: \n\n- Separate the creation of ntp.keys and key #1 in it to avoid\n  problems when upgrading installations that have the file, but\n  no key #1, which is needed e.g. by 'rcntp addserver'.\n\n- Update to 4.2.8p7 (bsc#977446):\n  * CVE-2016-1547, bsc#977459:\n    Validate crypto-NAKs, AKA: CRYPTO-NAK DoS.\n  * CVE-2016-1548, bsc#977461: Interleave-pivot\n  * CVE-2016-1549, bsc#977451:\n    Sybil vulnerability: ephemeral association attack.\n  * CVE-2016-1550, bsc#977464: Improve NTP security against buffer\n    comparison timing attacks.\n  * CVE-2016-1551, bsc#977450:\n    Refclock impersonation vulnerability\n  * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig\n    directives will cause an assertion botch in ntpd.\n  * CVE-2016-2517, bsc#977455: remote configuration trustedkey/\n    requestkey/controlkey values are not properly validated.\n  * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode \u003e 7\n    causes array wraparound with MATCH_ASSOC.\n  * CVE-2016-2519, bsc#977458: ctl_getitem() return value not\n    always checked.\n  * integrate ntp-fork.patch\n  * Improve the fixes for:\n    CVE-2015-7704, CVE-2015-7705, CVE-2015-7974\n- Restrict the parser in the startup script to the first\n  occurrance of 'keys' and 'controlkey' in ntp.conf (bsc#957226).\n\n","status":"published","published":"2016-06-01T12:36:52Z","modified":"2026-02-04T03:05:59.062347Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1568-1","title":"Security update for ntp","description":"ntp was updated to version 4.2.8p8 to fix 17 security issues.\n\nThese security issues were fixed:\n- CVE-2016-4956: Broadcast interleave (bsc#982068).\n- CVE-2016-2518: Crafted addpeer with hmode \u003e 7 causes array wraparound with MATCH_ASSOC (bsc#977457).\n- CVE-2016-2519: ctl_getitem() return value not always checked (bsc#977458).\n- CVE-2016-4954: Processing spoofed server packets (bsc#982066).\n- CVE-2016-4955: Autokey association reset (bsc#982067).\n- CVE-2015-7974: NTP did not verify peer associations of symmetric keys when authenticating packets, which might allowed remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a 'skeleton key (bsc#962960).\n- CVE-2016-4957: CRYPTO_NAK crash (bsc#982064).\n- CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion botch (bsc#977452).\n- CVE-2016-2517: Remote configuration trustedkey/requestkey values are not properly validated (bsc#977455).\n- CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065).\n- CVE-2016-1547: CRYPTO-NAK DoS (bsc#977459).\n- CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering (bsc#977450).\n- CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, authdecrypt-timing, AKA: authdecrypt-timing (bsc#977464).\n- CVE-2016-1548: Interleave-pivot - MITIGATION ONLY (bsc#977461).\n- CVE-2016-1549: Sybil vulnerability: ephemeral association attack, AKA: ntp-sybil - MITIGATION ONLY (bsc#977451).\n\nThis release also contained improved patches for CVE-2015-7704, CVE-2015-7705, CVE-2015-7974.\n\nThese non-security issues were fixed:\n- bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice.\n- bsc#981422: Don't ignore SIGCHILD because it breaks wait().\n- bsc#979981: ntp-wait does not accept fractional seconds, so use 1 instead of 0.2 in ntp-wait.service.\n- Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by 'rcntp addserver'.\n- bsc#957226: Restrict the parser in the startup script to the first occurrance of 'keys' and 'controlkey' in ntp.conf.\n  ","status":"published","published":"2016-06-14T06:45:46Z","modified":"2026-02-04T02:54:59.789302Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}